#zero-knowledge-proofs #field #elliptic-curve #snark #circuit #group #construction

no-std decaf377

A prime-order group designed for use in SNARKs over BLS12-377

9 releases (breaking)

0.8.0 Feb 5, 2024
0.7.0 Dec 12, 2023
0.6.0 Oct 24, 2023
0.4.0 Apr 25, 2023
0.1.0 Dec 1, 2022

#280 in Cryptography

Download history 1419/week @ 2023-12-04 1500/week @ 2023-12-11 709/week @ 2023-12-18 414/week @ 2023-12-25 835/week @ 2024-01-01 799/week @ 2024-01-08 1331/week @ 2024-01-15 1217/week @ 2024-01-22 2306/week @ 2024-01-29 1585/week @ 2024-02-05 2107/week @ 2024-02-12 961/week @ 2024-02-19 1601/week @ 2024-02-26 1373/week @ 2024-03-04 1525/week @ 2024-03-11 1521/week @ 2024-03-18

6,087 downloads per month
Used in 3 crates

MIT/Apache

1.5MB
36K SLoC

decaf377

Crates.io

Many zero-knowledge protocols require a cryptographic group that can be used inside of an arithmetic circuit. This is accomplished by defining an “embedded” elliptic curve whose base field is the scalar field of the proving curve used by the proof system.

The Zexe paper, which defined BLS12-377, also defined (but did not name) a cofactor-4 Edwards curve defined over the BLS12-377 scalar field for exactly this purpose. However, non-prime-order groups are a leaky abstraction, forcing all downstream constructions to pay attention to correct handling of the cofactor. Although it is usually possible to do so safely, it requires additional care, and as discussed below, the optimal technique for handling the cofactor is different inside and outside of a circuit.

Instead, applying the Decaf construction to this curve gives decaf377, a clean abstraction that provides a prime-order group, complete with hash-to-group functionality, and works the same way inside and outside of a circuit.

More details are available on the Penumbra website.

Features

  • std: default, for use in std environments,
  • r1cs: enables rank-1 constraint system gadgets,
  • parallel: enables the use of parallelism.

Benchmarks

Run criterion benchmarks using:

cargo bench

This will generate a report at target/criterion/report/index.html.

Dependencies

~2.6–4MB
~67K SLoC